Do you know what OFFWHITE Ransomware is?
OFFWHITE Ransomware is a malicious file-encrypting application that seems to be targeted at various businesses. As usual for such threats, the malware encrypts files that could be valuable and then displays a ransom note. The message should encourage victims to contact the malicious applications creators and get further instructions on how to receive decryption key and software to restore all the malware’s encrypted files. Since most ransomware applications are used for money extortion, we think that users who contact hackers will receive instructions on how to pay ransom. If you want to know why it might be dangerous to pay ransom or more about how this threat works, we invite you to read our full report. As for users who only wish to erase OFFWHITE Ransomware, we can offer our removal guide available at the end of the main text.
The reason why our researchers think that the malicious application could be targeted at various companies is because the malware’s note starts with: “Two things have happened to your company.” Unlike ransomware applications that are targeted at regular home users, file-encrypting threats like OFFWHITE Ransomware are often distributed through unsecured Remote Desktop Protocol (RDP) connections. Consequently, we highly recommend securing RDP connections if you must use them. You can do so by setting up a strong password and Two-Factor Authentication. Also, make sure that your software is always up to date so that there would be no exploitable weaknesses. Another good way to keep your system malware-free is to install a reputable antimalware tool that could warn you about threats and guard our computer against them.
If OFFWHITE Ransomware gets in, the malware should locate its targeted files and start encrypting them one by one with a strong encryption algorithm. Our computer security specialists say that the malware should encrypt all data except files that have the following extensions: .exe, .dll, .ini, .cpl, .lnk, .mp3, .mp4, .com. Also, files that get encrypted should be marked with an additional extension called .OFFWHITE, for example, document.docx.OFFWHITE, which should make it easy for users to recognize locked data. Once the encryption process is complete, the malicious application should change user’s Desktop image and drop a document with a ransom note.
OFFWHITE Ransomware screenshot
Scroll down for full removal instructions
OFFWHITE Ransomware’s ransom note might be called OFFWHITE-MANUAL.txt. The text in it should say that only hackers have the decryption tools that could decrypt all files. Plus, cybercriminals might claim that they made copies of files before encrypting them and that they will leak them if victims do not put up with hackers’ demands. The note might only ask to contact OFFWHITE Ransomware’s creators, but we believe that the further instructions should demand to pay ransom. Paying it would be risky because there are no guarantees that cybercriminals will send the promised decryption tools once you pay ransom. Thus, we advise thinking carefully if the encrypted files are worth losing your company’s money in vain.
Lastly, we advise removing OFFWHITE Ransomware because keeping it on the system could still be dangerous. Truth be told, the threat could delete itself after encrypting files, but we cannot be certain that it will happen on all infected devices. If you are up to the task, you could eliminate the malware manually by following the removal guide placed below this paragraph. Of course, we cannot guarantee that it will work for everyone. In any case, it might be easier and safer to erase OFFWHITE Ransomware with a reputable antimalware tool.
Erase OFFWHITE Ransomware
- Restart your device in Safe Mode with Networking.
- Press Windows key+E.
- Go to your Desktop, Temporary Files, and Downloads directories.
- Find the file launched before the threat infected the computer (the malicious file could be any recently downloaded document, installer, etc.).
- Right-click this suspicious file and click Delete.
- Go to: %TEMP%
- Find a file called scam.jpg, right-click it, and select Delete.
- Close File Explorer.
- Empty Recycle Bin.
- Reboot the system.
In non-techie terms:
OFFWHITE Ransomware is a vicious threat that can lock lots of valuable files without a victim noticing anything. Our computer security specialists say that the malicious application might be targeted at employees or owners of various companies. Soon after entering a system, the threat should lock various valuable files with a strong encryption algorithm. Next, the malware ought to display a ransom note in which it should threaten victims to leak their files if they do not put up with hackers’ behind the malware demands. The truth is that cybercriminals could ask for money. To make matters worse, the sum could be huge and there are no guarantees that hackers will hold on to their end of the bargain as usually, victims are asked to pay first. For those who have no intention to deal with cybercriminals, we advise erasing OFFWHITE Ransomware with a legitimate antimalware tool or our removal guide.